From the security perspective (and not usability as it's discussed here https://stackoverflow.com/questions/3648430/is-it-a-bad-idea-to-escape-html-before-inserting-into-a-database-instead-of-upon), why is it a bad idea to escape HTML before escaping SQL?

  • 4
    I think you may have misread the question and answers. I don't see anything about escaping SQL or SQL injection in there. – Xander May 23 '14 at 15:19
  • @Gumbo now thinking... what about the semicolon? Escaping HTML will introduce a semicolon (e.g. $quot;), and could not be this used to exploit the DB? – Ay0 May 25 '14 at 9:57
  • @yzT It would only appear within string literals, where it wouldn’t be interpreted as statement separator. – Gumbo May 25 '14 at 10:02

With regard to database security, it's irrelevant. SQL doesn't care if the string contains raw HTML or escaped HTML or whatever.

But as explained in the other question, this messes up the data. I would actually consider it a bug.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.